350-701 Practice Test 18 — 15 Questions

Question 1

A security administrator receives an alert that an email with an attachment was blocked by the Cisco Email Security Appliance (ESA). The attachment was identified as malware using cloud lookup. Which technology was used to detect the threat?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AMP for Email with SHA-256 cloud lookup. Cisco ESA uses Advanced Malware Protection (AMP) for Email, which performs SHA-256 cloud lookups to detect known malware.

Answer

IronPort SenderBase Reputation Score (SBRS)

Answer

Outbreak Filters

Answer

Data Loss Prevention (DLP) policies

Question 2

Which TWO of the following are common security objectives of the Cisco TrustSec solution? (Choose two.)

Accepted Answer

Microsegmentation of network traffic. Cisco TrustSec uses Security Group Tags (SGTs) to enforce microsegmentation by classifying traffic based on user, device, or role rather than IP addresses. This allows granular policy enforcement at the access layer, reducing lateral movement within the network. Microsegmentation is a core security objective of TrustSec, enabling dynamic, identity-based access control.

Answer

VPN termination for remote users

Answer

End-to-end data encryption

Answer

Network topology discovery

Question 3

An administrator is configuring Cisco ESA to protect against Business Email Compromise (BEC) attacks. Which TWO of the following features are most effective in detecting and mitigating BEC?

Accepted Answer

Data Loss Prevention (DLP). BEC attacks often involve spoofed or compromised accounts. DMARC helps prevent domain spoofing, and DLP can detect sensitive data being sent to unauthorized recipients. FTL (Forged Email Detection) is also relevant, but DMARC and DLP are standard ESA features for BEC.

Answer

SenderBase reputation

Answer

Outbreak filters

Answer

AMP for Email

Question 4

Refer to the exhibit. An ASA is configured with the above access-list and NAT rule. A web server is reachable from the internet via the public IP 203.0.113.10. However, internal users from the inside network cannot access the web server using its public IP address. What is the most likely cause?

Accepted Answer

The NAT rule is missing a static NAT for the server.. The NAT rule shown is a static NAT for the web server, but it is missing the 'static' keyword or the bidirectional mapping required for internal users to reach the server using its public IP. Without a proper static NAT (e.g., 'nat (inside,outside) static 192.168.1.10 service tcp www www'), the ASA does not translate the source IP of internal traffic destined to 203.0.113.10 back to the server's private IP, causing the traffic to be dropped or misrouted.

Answer

The access-list does not permit traffic from inside to outside for that destination.

Answer

The interface ACL is applied inbound on the inside interface.

Answer

The default route is missing.

Question 5

Refer to the exhibit. The tunnel is established but no traffic is encrypted. What is the most likely issue?

Accepted Answer

The crypto map is not applied to the external interface. The most likely issue is that the crypto map is not applied to the external interface. In IPsec VPN configuration, the crypto map must be applied to the interface that sends and receives encrypted traffic (typically the outside/public-facing interface). Without this application, the router does not know which traffic to protect or how to negotiate the IPsec tunnel, even if the tunnel is established (e.g., IKE Phase 1 completes). The tunnel may show as up due to successful ISAKMP negotiation, but no traffic will be encrypted because the crypto map's policy (including the access-list and transform set) is never enforced on the interface.

Answer

The transform set uses wrong encryption

Answer

The access-list is too permissive

Answer

The peer address is wrong

Question 6

A company deploys a web application firewall (WAF) from Cisco on AWS Marketplace. They want to integrate with AWS CloudTrail for logging. What is the primary benefit?

Accepted Answer

Centralized logging of WAF events in CloudTrail. Integrating a Cisco WAF deployed via AWS Marketplace with AWS CloudTrail provides centralized logging of all WAF events, including allowed and blocked requests, directly into CloudTrail. This enables a single, auditable log stream for security monitoring and compliance, as CloudTrail captures API calls and WAF events for analysis in AWS services like CloudWatch Logs or Amazon S3.

Answer

Simplified compliance reporting

Answer

Elimination of false positives

Answer

Automatic WAF rule updates

Question 7

A user reports slow performance when accessing cloud-based applications. Which Cisco tool provides visibility into SaaS application performance?

Accepted Answer

Cisco ThousandEyes. Cisco ThousandEyes provides monitoring and visibility into the performance of cloud and SaaS applications.

Answer

Cisco Firepower URL filtering

Answer

Cisco Umbrella SIG

Answer

Cisco WSA bandwidth controls

Question 8

Which THREE elements are essential components of a secure network architecture according to Cisco's SAFE model? (Choose three.)

Accepted Answer

Encryption for data in transit. Encryption for data in transit is a core component of Cisco's SAFE model because it ensures confidentiality and integrity of traffic traversing the network. SAFE mandates encryption protocols such as IPsec, TLS, or MACsec to protect against eavesdropping and man-in-the-middle attacks. This aligns with the model's principle of maintaining trustworthiness across all communication paths.

Answer

A single firewall at the internet edge

Answer

Large broadcast domains to simplify management

Question 9

A Cisco WSA administrator wants to apply different web usage policies based on user group membership. Which two methods can be used to identify users transparently? (Choose two.)

Accepted Answer

Active Directory integration. Transparent identification can use Active Directory or NTLM authentication without explicit proxy config.

Answer

Explicit proxy configuration

Answer

LDAP bind

Answer

WCCP redirect

Question 10

A network administrator is configuring Cisco WSA to intercept web traffic transparently. Which protocol should be used to redirect traffic from the router to the WSA?

Accepted Answer

WCCP. WCCP (Web Cache Communication Protocol) is used to transparently redirect web traffic from routers or switches to the WSA.

Answer

SSL/TLS Decryption

Answer

HTTP Proxy with PAC files

Answer

Active Directory integration

Question 11

A global company uses Cisco Umbrella to enforce security policies across roaming users. Recently, a user reported that they could not access a legitimate business application while connected to a guest Wi-Fi at an airport. The application is categorized as 'Productivity' in Umbrella. Other users outside the office can access it. What is the most likely reason?

Accepted Answer

The user's Umbrella roaming client is unable to authenticate, so the request uses the default policy which blocks the category.. When the Umbrella roaming client fails to authenticate, the user's DNS requests fall back to the default policy, which may block categories like 'Productivity' that are allowed under the authenticated user's policy. This explains why the user cannot access the application while other users outside the office can, as they are likely authenticated and subject to a permissive policy.

Answer

The application's category is blocked globally in the Umbrella policy.

Answer

The user is in a different geographic location with a stricter policy.

Answer

The guest Wi-Fi's public IP address is on a block list.

Question 12

A company wants to enforce that all outbound emails containing credit card numbers are blocked. Which Cisco ESA feature should be configured to achieve this?

Accepted Answer

DLP policies. Data Loss Prevention (DLP) policies on Cisco ESA can scan outbound emails for sensitive data like credit card numbers and block them.

Answer

Anti-Spam (SenderBase)

Answer

Outbreak Filters

Answer

AMP for Email

Question 13

A security analyst receives an alert that a user clicked a link in an email that led to a malicious website. The email was allowed by the Cisco ESA because it passed SPF, DKIM, and DMARC checks. Later analysis reveals the email was sent from a compromised account within the same domain. Which type of attack best describes this scenario?

Accepted Answer

Account takeover (BEC). When an attacker compromises a legitimate email account within the organization and uses it to send malicious emails, it is an account takeover attack, which is a form of Business Email Compromise (BEC). Since the email authenticated correctly, it bypassed email authentication checks.

Answer

Malspam

Answer

Spear phishing

Answer

Whaling

Question 14

An organization is using Cisco Firepower Threat Defense (FTD) with URL filtering to block access to social media sites during work hours. After implementation, users can still access Facebook and Twitter. The access control policy is configured correctly with a URL category condition. What should the administrator verify first?

Accepted Answer

Confirm that the FTD is configured with a DNS policy to perform DNS snooping for URL filtering.. Cisco FTD uses DNS snooping to map domain names to IP addresses for URL filtering when SSL decryption is not enabled. Without DNS snooping, the FTD cannot reliably associate traffic with the requested URL category if the traffic is encrypted, leading to bypasses like users accessing Facebook and Twitter despite a blocking rule.

Answer

Ensure that SSL decryption is enabled for the relevant traffic.

Answer

Check that the URL filtering rule is above any other permit rules.

Answer

Verify that the FTD has an updated URL filtering database.

Question 15

An engineer is configuring ISE for guest access via a sponsor portal. The policy requires that a sponsor must approve each guest. However, guests are being automatically approved without sponsor interaction. What is the most likely misconfiguration?

Accepted Answer

The guest portal's 'Access setting' is set to 'Self-Registration' instead of 'Sponsor Approval'. The guest portal's 'Access setting' must be configured to require sponsor approval. If it is set to 'Self-Registration', guests are automatically approved upon registration without any sponsor action, which matches the described symptom. Option B is incorrect because email notifications to sponsors are optional and do not affect the approval process itself. Option C is incorrect because the sponsor group assignment determines which users can act as sponsors, not whether approval is required. Option D is incorrect because profiling a guest endpoint as a known device would affect authentication methods, not the approval workflow.

Answer

The guest portal is not configured to send email notifications to sponsors

Answer

The sponsor user account is assigned to the wrong sponsor group

Answer

The guest endpoint is being profiled as a known device